From:   Russell Coker <russell@coker.com.au>
To:     Chris PeBenito <pebenito@ieee.org>
Reply-To: russell@coker.com.au
Cc:     "Sugar, David" <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: Re: [PATCH] Add kernel_dgram_send() into logging_send_syslog_msg()
Date:   Sat, 13 Apr 2019 15:35:35 +1000
Message-ID: <1987619.JXgbzmF0Gi@xev>
In-Reply-To: <25dded62-a45b-5cc0-4f76-0c813b89c0b9@ieee.org>
References: <20190409150948.10882-1-dsugar@tresys.com> <1597016.RvrILB9U20@liv> <25dded62-a45b-5cc0-4f76-0c813b89c0b9@ieee.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On Friday, 12 April 2019 9:54:46 PM AEST Chris PeBenito wrote:
> On 4/9/19 9:39 PM, Russell Coker wrote:
> > Why is a socket that everything sends to labeled as kernel_t?
> > 
> 
> Russell, you aren't seeing this type of access on Debian?


        ifdef(`init_systemd',`
                init_domain($1, $2)
                # this may be because of late labelling
                kernel_dgram_send($1)

                allow $1 init_t:unix_dgram_socket sendto;
        ')

The above is in the upstream policy in the init_daemon_domain() interface.  
Not sure why.

I've put in an auditallow rule and so far haven't been able to reproduce it.  
So we can probably remove that line.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/